Changeset 6183

Timestamp:

10/03/2007 04:17:54 PM (17 years ago)

Author:

ryan

Message:

Add sanitize_url. Don't convert ampersands in URLs when saving to DB. fixes #4411 for 2.3

Location:

branches/2.3/wp-includes

Files:

• default-filters.php (modified) (1 diff)
• formatting.php (modified) (3 diffs)
• widgets.php (modified) (1 diff)

branches/2.3/wp-includes/default-filters.php

@@ -26 +26 @@
 }
 
-// URL
+// Save URL
 $filters = array('pre_comment_author_url', 'pre_user_url', 'pre_link_url', 'pre_link_image',
-    'pre_link_rss', 'comment_url');
+    'pre_link_rss');
+foreach ( $filters as $filter ) {
+    add_filter($filter, 'strip_tags');
+    add_filter($filter, 'trim');
+    add_filter($filter, 'sanitize_url');
+    add_filter($filter, 'wp_filter_kses');
+}
+
+// Display URL
+$filters = array('user_url', 'link_url', 'link_image', 'link_rss', 'comment_url');
 foreach ( $filters as $filter ) {
     add_filter($filter, 'strip_tags');

branches/2.3/wp-includes/formatting.php

@@ -1088 +1088 @@
 }
 
-function clean_url( $url, $protocols = null ) {
+function clean_url( $url, $protocols = null, $context = 'display' ) {
     $original_url = $url;
 
@@ -1104 +1104 @@
         $url = 'http://' . $url;
 
-    $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+    // Replace ampersands ony when displaying.
+    if ( 'display' == $context )
+        $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
+
     if ( !is_array($protocols) )
         $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet');
@@ -1110 +1113 @@
         return '';
 
-    return apply_filters('clean_url', $url, $original_url);
+    return apply_filters('clean_url', $url, $original_url, $context);
+}
+
+function sanitize_url( $url, $protocols = null ) {
+    return clean_url( $url, $protocols, 'db');
 }
 

branches/2.3/wp-includes/widgets.php

@@ -1002 +1002 @@
     if ( $_POST["rss-submit-$number"] ) {
         $newoptions[$number]['items'] = (int) $_POST["rss-items-$number"];
-        $url = clean_url(strip_tags(stripslashes($_POST["rss-url-$number"])));
+        $url = sanitize_url(strip_tags(stripslashes($_POST["rss-url-$number"])));
         $newoptions[$number]['title'] = trim(strip_tags(stripslashes($_POST["rss-title-$number"])));
         if ( $url !== $options[$number]['url'] ) {